US and UK gov cyber defences = big boys' trough-slurp

Commitments by the UK government and others to improve cybersecurity by increased spending are more likely to benefit established security vendors with well-oiled lobbying machines than innovative start-ups, according to one of the pioneers of the industry segment.

Nir Zuk, chief technology officer at Palo Alto Networks, reckons web applications have made the traditional firewall technologies he helped to develop obsolete, despite their ubiquity in both government and business.

"The firewall was designed to block someone from the outside connected to servers on inside," Zuk said. "Web applications have changed that so that the traditional stateful inspection firewall - invented by Check Point 15 years ago - doesn't do anything any more."

You might as well take traditional firewalls and "replace them with an Ethernet cable," Zuk reckons.

The traditional approach of using ports and protocols to either block or allow traffic can't hope to succeed. Palo Alto's technology is designed to allow enterprises to regain control of applications, providing greater visibility of what's going on in a network.

A different approach is needed because everything for enterprise applications, such as salesforce.com, through VoIP to worms all come in and out through HTTP traffic and the web. Just blocking or allowing ports or protocols, the functions of a traditional firewall, no longer makes much sense.

Plenty of security firms play in the application control space, mostly using application control technology installed on the desktop or via intrusion prevent systems. Palo Alto is trying to attack the problem at the network level and via a next generation firewall that it hopes large enterprises will use as an upgrade from legacy Cisco, Check Point or Juniper kit.

Zuk left service with a branch of Israeli military intelligence to help Check Point develop Firewall 15 years ago. The developer was four years younger than the three founders of Check Point, as a result of which he left the firm wealthy but not set up for life.

He went on to NetScreen, which was acquired by Juniper Networks in 2003. "I spent 11 months banging my head before I tired of life at Juniper and left to start Palo Alto, building the technology I tried to start inside Juniper but wasn't able to."

Zuk founded Palo Alto in 2005, two years before the firm began selling products in 2007. He remains in the business because he "likes to build technology" and solve things. Zuk is also in business to make money, of course, and it might be thought that recent commitments by the government in the UK and the US to spend more on infrastructure protection would be good news for the likes of Palo Alto.

This isn't necessarily so, however. "I don't know about the UK but in the US money gets spent on the vendors who spend millions lobbying Congress," Zuk told El Reg.

"In the information security arena governments do the same thing, just more of it when there are higher budgets for cybersecurity. This, according to Zuk, translates into buying more kit from the likes of Cisco and paying expensive consultants.

"Money is shut out from start-ups," he told El Reg. "It's a cycle and I don't know how to break it."

Zuk made the comments during a presentation in the city of London and a subsequent interview during a rare visit to the UK on Wednesday. ®